macOS Log/copy all files that are created by a process

[seson]

Hi,

I'm wondering how I could monitor a process and check for files that the process creates. I know lsof shows me all files that a process has opened and that are still open.

Basically, I need something like lsof 1000 times a second. I'm wondering if this is the only solution, or if there's something better suited for this purpose (like dtrace or so)

Thanks
-Sebastian

 

[robbieduncan]

FSEvents?

 

[chown33]

Is this for a program you have the source for, or any arbitrary program?

If you have source, what language?

Have you looked at dtrace and found it lacking, or was your comment more like, "I know nothing about dtrace, but I could be persuaded to look into it if it seems worthwhile."?

From the Wikipedia dtrace page:

# Files opened by process,
dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'

Found by googling: mac os dtrace
http://www.mactech.com/articles/mactech/Vol.23/23.11/ExploringLeopardwithDTrace/index.html
http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man1/dtrace.1.html

Dtrace requires OS 10.5 or higher, and Developer Tools installed.


There's also the fs_usage command, which seems tailor-made for this, given the pid option.